Security Consultant, AppSec

Cyderes (Cyber Defense and Response) is a pure-play, full life-cycle cybersecurity services provider with award-winning managed security services, identity and access management, and professional services designed to manage the cybersecurity risks of enterprise clients. We specialize in multi-technology, complex environments with the in speed and agility needed to tackle the most advanced cyber threats. We leverage our global scale and decades of experience to accelerate our clients’ cyber outcomes through a full lifecycle of cybersecurity services. We are a global company with operating centers in the United States, Canada, the United Kingdom, and India.

Responsibilities:

• Lead security reviews and web application penetration tests to identify vulnerabilities across a variety of development frameworks and languages.
• Advise on the integration of security practices within DevOps processes, aiding in the transition to DevSecOps.
• Perform thorough code reviews using DAST, SAST, and SCA tools, focusing on a wide array of programming languages.
• Work closely with development teams to instill secure coding practices and embed security measures within CI/CD pipelines.
• Support the bug bounty program.
• Support the preparation of security releases.
• Assist in development of security processes and automated tooling that prevent classes of security issues.

Requirements:

• 2-3 years overall application security experience
• Extensive experience application and code security
• Experience with static and dynamic code analysis solution. For Example: Veracode, Checkmarx, SonarQube
• Retain one or more of the following certifications: CISSP, CISM, OSCP, CEH
• Experience in solution architecture, DevSecOps practices, and cloud integration.
• Experience working with Infrastructure as Code, CI/CD pipelines and Secure DevOps processes.
• Working knowledge of common and industry standard cloud-native/cloud-friendly authentication mechanisms (OAuth, OpenID, SAML, etc.).
• Strong expertise in at least one of the major programming languages (e.g., C/C++, Java, Python). This foundational knowledge is crucial for conducting effective code reviews and security assessments.
• An understanding of, or experience with, a diverse set of languages, including but not limited to Gosu, Business Basic, CLI Scripts, HCL Domino, Net.Data, PowerShell, Shell, SQL, and SQR.
• Strong security inclination & technical writing skills